Europaisches 
Patentamt 



European 
Patent Office 



2^ UCCT m _ 

^ PCT 



WiPG 



Bescheinigung Certificate 



Attestation 



Die angehefteten Unterla- 
aen stimmen mit der 
ursprGnglich eingereichten 
Fassung der auf dem nach- 
sten Blatt bezeichneten 
europSischen Patentanmei- 
dung Gberein. 



The attached documents 
are exact copies of the 
European patent application 
described on the foUowmg 
page, as originally filed. 



Les documents fixes a 
cette attestation sont 
conformes a la version 
initialement deposee de 
la demande de brevet 
europeen sp6cifiee a la 
page suivante. 



03292219.7 




Der President des Europaischen Patentamts; 
lm Auftrag 

For the President of the European Patent Office 
Ue President de .'Office europeen des brevets 
p.o. 



r c van Dijk 



BEST AVAILABLE COPY 




Europalsches 
Patentamt 



European 
Patent Office 



Office europeen 
des brevets 



Anmeldung Nr: 
Application no. 
Demande no: 



03292219.7 



Anmeldetag: 
Date of fH1 n 9: 
Date de depdt: 



09.09.03 



Anmelder/AppUcantCs)/DemandeurCs): 

Schlumberger Systeroes 
50, avenue Jean Jauxes 
92120 Montrouge 
FRANCE 

i.4«n/Ture de 1 'invention: 
Authentication In data communication 

revendlqufie(s) n0 . /Pays/Date/Numero de depot: 



Classification Internationale des brevets. 
H04L29/06 

, te Vertrags taaten/Contract1ng states designated at date of 

AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HO IE IT LU MC NL 
FT R0 SE SI SK TR LI 



03292219.7 
EPA/EP0/0EB Form 1014.2 - 01. 



7001014 



2 



AUTHENTICATION IN DATA COMMUNICATION 

Field of the Invention . ' 

This invention relates to authentication ;in data communication. In particular the 
invention "relates to. but is not limited 5 to. authenticating mobile stations and 
network servers communicating with each other through a network such as the 
Internet 

The example which will illustrate the invention is that of a" mobile communication 
system comprising ^ network and mobile stations. In this 

example, the network provides a service to a mobile station after authentication of 
the mobile station. The. mobile station comprises a. portable module such as- a 
USIM card and comprises mobile equipment that is able to communicate wrth the 
network and that is able to communicate with me Pbrtablfe module. 

Prior Ait 

The actual third generation <3G) standards (in particular TS 31.102 and I TS 
33102) define the authemication protocol in- a 3G ^twork (known as AKA 
protocol, standing: for Authentication^ Agreement) between the USIM and an 
Authentication Center (AuC). .. . . : 

in tois frame^rkV the card is sent a so-called aiithen^tibn requesi m^de up of 

several data fields: \ ■ - ■•■ 

- a random challenge (RAND): "... 

'-" a sequence number (SON) or a concealed sequence number (SQN^Ak) 
' "a message authentication code (MAC); . . .. .. . 

AK bBing an anonymity; key. the symbol .€> being the bitwise .Exclusive or, MAC 
being a Message Authentication Code.^QN. -Mnfre sLeQuence number, stating rf 
the above request is a replayed request pr not according to itsvalue; ' 
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Upon receipt of these data fie.*. •» *> «™P" teS SQN ( * ^ 
the MAC and checks the freshness of SCjN. . . 

To compute the SQN(if required), the US1M computes: ^ 
: - the anonymity key AK with a function 15 (RANQ.K) ^. „ _ 

. ^ Eventually; retrieves: thVsequen^Wumfaer SQN by way of (SON® AK) ft 



AK=SQN 
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« is a key generating function used to compute AK 
K„, Uong^erm secret Key shared beWeen the card US.M and the sen*r. 

■men the card US.M also generates an expected message auWenBcatton coite 
S^S* RANO.; K%N .an ejdhktna. management r,e*(A« end a 
authentication function f1 . V /-.V; 

Then the US.M 'oohipares the XMAC & the MACS wWchiwas Inck^'lh the 

reject rhessage back to the handset W«« an ind^n of *e cause and the 
abandons the ongoing au.hen«ca««oh ^dure. .n this «~ "V* 0 . 
Mate a new identification and authentication procedure towards the Cent. . 

, Tbe US1M atso Verifies that the re^edaeguenea number SQN ts * fttf* 
The SQN may not d«er mo,* Mff by a p^eterhWed 
nTby the USIM. « the US,M consider the se<*enc* 
c^eJmnSe; it sends synchron^on fatiure message beck to the AuC and 

abandons the ongoing procedure. ^ ■ _ ; . - 

5 WewlVr^Wabove-^^ 

on the aboVe steps. " ' ' ' 

The code MAC (and therefore XMAC) fcrtti* ^ the whole reqO^ ^ 
The code Mao \ „ ^ is te ensure' « the request data has 

30 and the same authentication key. its roie * . .... ... 



not been tempered during the transmission and also warrants the card that the 
requesting entity actually possesses the/same authentication key as the card. 

As the card is checking the integrity andiuthenficity offe data received from the 
5 server, 1 ** card computes said XMAC&vi* > mechanism Involving^ 'data £> 
check along with the authentication Key K. Then, an attacker c*n : force the 
utilization of the authentication key by sending to the card an authentication 
request with strategically chosen data. By verioue methods, such as side-channe 
and pertuibation attacks, intormatlon isfrevealed, leading to the partial or total 
10 disclosure ofth'e authentication key. 

To be exploitable, most attacks require tf given amount of authentication request 
depending on the' strength of the algorithm I used to ^compute^he XM/^. For each 
bf^hese trials, the attacker must providi a dtirnmy M/^ (since itdoe.n^now 
15 the actual value of the key). . ;f ........ ... ,... ? . .;.,:>■ -•• . 

Thfe Invention ■ ;. .-• - 

The >im of the invention is to limit the Humber of consecutive attacks on a ; card 
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usim: 



Accbrding to the ihventioKeach time the two codes (MAC, XMAC) don trnatcb 
the ^authentication procedure is aborted!? counter. I^eping trace of tttjj humber of 
occurrences of abortion, in other words^the iriventton^ consists in associating the 
challenging step between MAC and XMAC with a faiiure. counter .in order : to 
restrict the number of successive erroneous trials to a, maximum amount, above 
which the key K is considered as compromised. ... ; • 

in this way. the number of malicious successive attacks is cbntrqiled. So. the card 
is a tamper resistant device, which is now more secure. : , • 



n « be easier to understand the invent oh reading the description betow. 
algorithm. 
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Piaure 1 represents a system SYS M&diog a . user equipment communlotfng 

The user equipment, consists of two parts:, the Mobile . Equipment- ME ; 9hd the 
Subscrtber^lentity Module CARD. The niobiie equipment ME is the 
used for radio communication between the user equ.pment and 
too* Lmple the card CATO » a 0|. M smart, card that hoids the subscnber 
, STtw^ o^mms, and stores authentic*** .and 
^^^^ 

The serve, SEW is a b te : to P^ service to ^ mbbHe sto«on «Pr; 3 
successful authentication of the mobile station. . ^ , ., 

" Adding to the invent a counter ^onW the number of 

ebTrted by the card. Preferabiy. counter oouhte successive aborted 
authentications. ••-/ •• ' *■'■ 

M .Figure' 2 is an algorithm, which ^illustrate cieany the Invent. The 
authentication includes several steps (S1-S16) „■:•,;,' A: ■ 



In a fii-st step (S1) f the card receives an authentication request. 

In a. second step (S2), before checkirip the MAC, the card checks the errc 
courfte'rr V: r • ; *^ : f ■ ■ -v 

- If the counter is zero (S3, SlS), vit considers that the key is compromise* 
and does not go further. In this". case, the card returns a security erro 
message (step S14). After step S14, the authentication procedure is 
finished (S15) . - 

. - Else (S3.S4), it can use the key and verify (S5). the data provided MAC. 
" ' ' o if the value ^ ekpected bV^the card does hot match with the one 
provided in. the request, then .the cerd decreases the errbr counter 

o Else it checks the SQN ofthe. request (S6), to ensure that it Is not 
processing a request, whicfi is being replayed. 

■ If the SQN appearsrnot to be fresh (S7:S10), then the card 
sends back a resynchronizatioh token over the rief^d'rk (S1 0) 
r as defined in the AKA. After S10, the procedure is finished 

.''"v . ..(si.iV '! 6 f ,f V ' [\ 

'* ■ ' Else, if the SQN appears to be vaJid.:.(S7,S8), "fan. in our 
exaVhpie, this ' card^fesete' ^"©rfcir' "'cdunter to: Its* • maxima! . 
valuelssj. After, tn^.card can' send, a positive authentication 
result "(S9). Step : S16 is. ^ .erul' bf the authentication 
• procedure. 

Once the error counter reaches zero, then the autfientication key n'0 Ipnger .cah 
be used. Thus, it aliows only a small amount of consecutive errors^ The aboviB- 
mentioned attacks require trials leading to MAC. verification errors. Then the 
counter limits the number of trials and th&n the attack is biased. 



assume that the tnltisl v*» * *o counter Is. 1.. These 6 
authentications illustrate several possibte^cenanos. ..., s , ? 

5 ifLAjffie^^ 

Initial value of the counter. 1 .. 

As the counter is strictly positive (S3), * ^ v 



10 (S4> ' Wr ™ n t/S^ a SQN verification is performed (S6) v L^. 

The authentication result is returned (S9) . 
is Ri£X^W*wc«to^3 ' 

? nd ^^i^i^r Counted • , . . ?S .' 

initial value of the counter. 3 ' , 

. Recepuon of me venftcation W performed 

M . As the counter is strictly pos«h«* « 

' £1 MAC is incorrect (S5>, *e*ountor Is decremented. The new value 
. ..of the counter is 2 (S13) .; 
a security error is returned (S14) : \ 
2 5 Final value of the counter. 2 .. ... 

Initial value of the counter: 2 . ■; - ;* 

Reception of the authentication reo.uest (S1> 
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- As the counter is strictly positive; (S3), a MAC verification is performec 
(S4). 

- AS the MAC is correct (S5), a SQN verification is performed (S6) 

- As the SQN is invalid (S7), a ^synchronization token is sent. The countei 

• ,> • . . •. :•• . •• •••• >v'.: - ■■■■> 

5 is not modified. Its remains equal ^to 2. 

Final value of the counter: 2 

4* Authentication: Counter >0 , Incorrect MAC 

Initial value of the counter: 2 . , 

10 - f^okiftiodff'air ttie'&itiiain*k»lion. rcN|iJiMit'<81 )" '" 

- As the counter is strictly positive ($3), a MAC verification is performed 

(S4). . i, 

- As the MAC is incorrect (S5), th^cburifer is decremented. The- new Value 
of the counter is 1 (SI 3) 

15 - A security- error is returned (S14) 
Final value of the counter: 1 

5 th Xuthentidatiori: Counter >0 . incorrect MAC , 
Initial vafiie of the counter: i 
20 - Reception of the aimemcam)htr^u^ : (S ! li 

- As the counter is strictly positive (S3),, a MAC. verification is performed 

- As the MAC is incorrect (S5), the counter is decremented. The new value 
of the counter is 0 (SI 3) 

is -., '. A security error is returned (S14) . ' 
Final value of the counter: 0 

6* Authemication: Counter sQ ...in correct MAC .... . 

Initial vaiue of the counter: 0 . f.';.'" ... 
30 - Reception |bf the authentication request(Si) . 



. m the counter is equa. too (S3), ^ Key is blocked (S12) 

_ A security error Is returned (S14) 
FinaWalue of the counter; 0 -.. . 

^^SSSSS^ incorrect MAC ^ - 

SQNi 1? H^cessaiily InvaW arrf. *e =ounwf « 

" ; : ^enticetienN-3) _ J. ^ b|ocklng me ^, as the 

- Problems with the freshness of ffJN do not n 

Lnter * not decreased. (Cfttojbove Authentic. N 3, ... 
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Several artenietives exist . ..' J 

. The values of the counter ere example. 
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invalid. 



The values or tne cou..«*. , ... . - t^^MAa 

The counter (nene^ ceWdlrter. 

in^ofdec^ 
fc anV other value than 0 etc..: 

Theluntorcen Countthe tote. amount of euthen^n^ 
counts -mhlr of incorrect MACS wthput possi 



CLAIMS: 

1. Method of authentication in ;: a system comprising two entities 
communicating between themselves by way of a network (NET), a first 

5 ' ehti$ (CARD) authfenticatihg a s&ond one (SERVER) and data received 
from said second entity, each entity storing tho same secret key (K). said 
first entity receiving a message/: authenticating code (MAC) and other 
parameters. (RAND. SQN, AMF,?...). the message authenticating code 
(MAC) calculation including the key K and said other parameters (RAND, 

10 '*•'• SON, AMF, ...), the authentication procedure consisting in challenging the 
received code (MAC) and an expected code (XMAC), the expected code 
being computed in using the received parameters; airid ijhs key : K«U^> 
Said first "entity, charactered ;in: that eath time thV *wo codes (MAC, 
XMAC) donT m^. the aWnerlcatod 'procedure' is aborted; a failure 

is counter storing the number of occurrences of abortion. ..... 

2. Method according to claim 1 characterized in that each time an 
authentication is launched, the smart card Vhebks the faiiufe c^untier 
. before* beginnlng'tHe auth^ntication - prc<seaure: 

3. Method according to claim 1, characWrked in that the card also performs a 
20 theck on the "(SON) replay parameter and 1 

is: aborted diie to an erroneous (Sgfoy. trie counter is not modifieid- 

4. Method' according to claim 1 or 3VpharacWnzed in.thatifthe autoentlcjtiph 
procedure is aborted and the sequence number Is fresh, thf cdunter is 
reset to its initial value. .5 ' 

25 5. A smart card (CARD) able to authentify. a remote entity (SERV) ah^d data 
received from it, said card storing authentication algorithms, authenf icatioh 
and encryption keys, said card arid said server storing the same secret key 
k? said card receiving a message authenticating code (MAC) arid I crther 
parameters (RAND, SQN, AM F , y ) f rofh said server , calculation of (MAC) 

30 taduoihg the key K and said^ OtheV parameters, the authentication 
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: u ., ™„n the received code (MAC) and an 

I"*** consisting in computed* *>,ng the 

exp ected code ^«JS;^*--^ 
received parameters and the keyK stored of 

saW smart card stores a Wu« counter able to store , ^ 
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Abstract r 

Method of authentication in a system comprising two entities communicating 
between themselves by way of a network, a first entity (CARD) authenticating i 

5 second one (SERVER) and data receded from said second entity^ch entit; 
storing the same secret key K, said first entity receiving a message authenticating 
code (MAC) and other parameters (RAND, SON, AMF, ...). the message 
authenticating code calculation including the key K and said other parameters 
(RAND. SQJN, AMF, ...), the authentication procedure consisting in challenging 

10 the" received code (MAC) and an expected code (XMAC), the expected code 
being computed in using the received parameters and the key K stored in said 
first entity, characterized in that each 'fime me two codes (MAC, XMAC) ;don't 
match,, the authentication procedure 'is aborted, a failure countef ^ofing the 
number of occurrences of 'abortion. ; .. 

15 ' ' / ............... 

Figure 2. . . . . ... 




Figure I 
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